Description
Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3983.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Oracle DB SQL Injection via SYS.LT.REMOVEWORKSPACE
auxiliary/sqli/oracle/lt_removeworkspace
Exploit-DB 1
- Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection EDB-7675 · local · Jan 6, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oracle-database-workspace-priv-escalation3(45887) vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html
- 32291 third-party-advisory
- 1021050 vdb-entry
- ADV-2008-2825 vdb-entry